MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c1cfc9920064f5e908e75ab4403c490aa080146bc2999009dc2096ff28ccab03. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	c1cfc9920064f5e908e75ab4403c490aa080146bc2999009dc2096ff28ccab03
SHA3-384 hash:	41cd30fc4b2a64546652a4e405916f82a9996f64f74d9a814e9acc11fe0d3a96690c16c19f5959c24cff887d203efc41
SHA1 hash:	f98c13906828bb603665419bc8b59c7535cec5ef
MD5 hash:	c246285dfd166ad79492fbb4037fa274
humanhash:	crazy-emma-nitrogen-tango
File name:	ACH.hta
Download:	download sample
Signature	RemcosRAT Alert Create hunting rule
File size:	15'267 bytes
First seen:	2026-09-23 12:32:39 UTC
Last seen:	Never
File type:	hta
MIME type:	text/html
ssdeep	48:3Piw0wL8k4vc0G1GmMlw3oICToISOU0ODAsPG:/iw0MV4Z957STp+
TLSH	T10A6265F98AA0E54F42A8F0989D802C4341D88A3B87C82D55B5AC54F777A535DCCBA6CF
Magika	txt
Reporter	abuse_ch
Tags:	hta RemcosRAT

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

89

Origin country :

DE

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

SecuriteInfo.com.Script.SNH-gen.18877119.UNOFFICIAL

Alert

Create hunting rule

SecuriteInfo.com.Script.SNH-gen.74995346.UNOFFICIAL

Alert

Create hunting rule

DocGuard Malicious

Result

Verdict:

Malicious

File Type:

HTA File - Malicious

Link:

https://app.docguard.net/c1cfc9920064f5e908e75ab4403c490aa080146bc2999009dc2096ff28ccab03/results/dashboard

Payload URLs

URL

File name

http://31.70.122.27/25/iamgoodforu.vbE

HTA File

Behaviour

BlacklistAPI detected

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

powershell

Link:

https://www.filescan.io/uploads/6ab3c71073ad2a8eb71cfe6b/reports/aaba5d68-a100-4bdf-8c83-f60a7330fdaa/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/c1cfc9920064f5e908e75ab4403c490aa080146bc2999009dc2096ff28ccab03

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

html

First seen:

2026-09-12T20:00:00Z UTC

Last seen:

2026-09-25T02:25:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/c1cfc9920064f5e908e75ab4403c490aa080146bc2999009dc2096ff28ccab03/results?tab=lookup

Joe Sandbox Remcos

Result

Threat name:

Remcos

Alert

Create hunting rule

Detection:

malicious

Classification:

rans.troj.spyw.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1976775

Signature

.NET source code contains method to dynamically call methods (often used by packers)

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Bypasses PowerShell execution policy

C2 URLs / IPs found in malware configuration

Contains functionality to bypass UAC (CMSTPLUA)

Contains functionality to register a low level keyboard hook

Contains functionality to steal Internet Explorer form passwords

Contains functionalty to change the wallpaper

Detected Remcos RAT

Encrypted powershell cmdline option found

Found malware configuration

Joe Sandbox ML detected suspicious sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

PowerShell case anomaly found

Sigma detected: Potentially Suspicious PowerShell Child Processes

Sigma detected: Remcos

Sigma detected: Script Initiated Connection to Non-Local Network

Sigma detected: Suspicious Encoded PowerShell Command Line

Sigma detected: Suspicious MSHTA Child Process

Sigma detected: Suspicious PowerShell Parameter Substring

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

System process connects to network (likely due to code injection or exploit)

Tries to harvest and steal browser information (history, passwords, etc)

Unusual module load detection (module proxying)

Uses dynamic DNS services

Windows Scripting host queries suspicious COM object (likely to drop second stage)

WScript reads language and country specific registry keys (likely country aware script)

Wscript starts Powershell (via cmd or directly)

Yara detected Generic JS Downloader

Yara detected Powershell decode and execute

Yara detected Remcos RAT

Yara detected UAC Bypass using CMSTP

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/c1cfc9920064f5e908e75ab4403c490aa080146bc2999009dc2096ff28ccab03

Malva.RE inconclusive

Verdict:

inconclusive

YARA:

3 match(es)

Tags:

Html PowerShell

Link:

https://app.malva.re/file/c246285dfd166ad79492fbb4037fa274

CERT.PL MWDB remcos

Detection:

remcos

Alert

Create hunting rule

Link:

https://mwdb.cert.pl/sample/c1cfc9920064f5e908e75ab4403c490aa080146bc2999009dc2096ff28ccab03/

ReversingLabs TitaniumCloud Script-WScript.Backdoor.Remcos

Threat name:

Script-WScript.Backdoor.Remcos

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-09-11 00:09:20 UTC

File Type:

Text (HTML)

Extracted files:

1

AV detection:

13 of 38 (34.21%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=yhh4teqamt26schhlk2eapcjbkqiafdlykmzaco4eclp6kgmvmbq._file

Threatray FantomCrypt Remcos

Verdict:

malicious

Label(s):

FantomCrypt

Alert

Create hunting rule

Remcos

Alert

Create hunting rule

Link:

https://reports.threatray.com/8efadd34-789a-41b1-b483-618f69239061

Hatching Triage remcos

Result

Malware family:

remcos

Alert

Create hunting rule

Score:

  10/10

Tags:

family:remcos botnet:remotehost collection discovery execution rat

Link:

https://tria.ge/reports/260923-pra1gazyfx/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

Command and Scripting Interpreter: PowerShell

Enumerates physical storage devices

Executes a command shell one-liner

System Location Discovery: System Language Discovery

Executes a VBScript file via the Windows Script Host.

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Checks computer location settings

Badlisted process makes network request

Family: Remcos

Malware Config

C2 Extraction:

shipping09.duckdns.org:14555

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/c1cfc9920064f5e908e75ab4403c490aa080146bc2999009dc2096ff28ccab03